>
-
diff --git a/fix_systemd.patch b/fix_systemd.patch
deleted file mode 100644
index 11c069c..0000000
--- a/fix_systemd.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-Index: fedora-policy-20230116/policy/modules/system/systemd.te
-===================================================================
---- fedora-policy-20230116.orig/policy/modules/system/systemd.te
-+++ fedora-policy-20230116/policy/modules/system/systemd.te
-@@ -381,6 +381,10 @@ userdom_manage_user_tmp_chr_files(system
- xserver_dbus_chat(systemd_logind_t)
-
- optional_policy(`
-+ packagekit_dbus_chat(systemd_logind_t)
-+')
-+
-+optional_policy(`
- apache_read_tmp_files(systemd_logind_t)
- ')
-
-@@ -863,6 +867,10 @@ optional_policy(`
- dbus_system_bus_client(systemd_localed_t)
- ')
-
-+optional_policy(`
-+ nscd_unconfined(systemd_hostnamed_t)
-+')
-+
- #######################################
- #
- # Hostnamed policy
-@@ -1195,6 +1203,8 @@ systemd_unit_file_filetrans(systemd_gpt_
- systemd_create_unit_file_dirs(systemd_gpt_generator_t)
- systemd_create_unit_file_lnk(systemd_gpt_generator_t)
-
-+kernel_dgram_send(systemd_gpt_generator_t)
-+
- optional_policy(`
- udev_read_pid_files(systemd_gpt_generator_t)
- ')
diff --git a/fix_systemd_watch.patch b/fix_systemd_watch.patch
deleted file mode 100644
index 72073ab..0000000
--- a/fix_systemd_watch.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-Index: fedora-policy-20230206/policy/modules/system/systemd.te
-===================================================================
---- fedora-policy-20230206.orig/policy/modules/system/systemd.te
-+++ fedora-policy-20230206/policy/modules/system/systemd.te
-@@ -1524,6 +1524,12 @@ fstools_rw_swap_files(systemd_sleep_t)
- storage_getattr_fixed_disk_dev(systemd_sleep_t)
- storage_getattr_removable_dev(systemd_sleep_t)
-
-+#######################################
-+#
-+# Allow systemd to watch certificate dir for ca-certificates
-+#
-+watch_dirs_pattern(init_t,cert_t,cert_t)
-+
- optional_policy(`
- sysstat_domtrans(systemd_sleep_t)
- ')
diff --git a/fix_thunderbird.patch b/fix_thunderbird.patch
deleted file mode 100644
index 159afc4..0000000
--- a/fix_thunderbird.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-Index: fedora-policy-20210628/policy/modules/contrib/thunderbird.te
-===================================================================
---- fedora-policy-20210628.orig/policy/modules/contrib/thunderbird.te
-+++ fedora-policy-20210628/policy/modules/contrib/thunderbird.te
-@@ -138,7 +138,6 @@ optional_policy(`
- optional_policy(`
- gnome_stream_connect_gconf(thunderbird_t)
- gnome_domtrans_gconfd(thunderbird_t)
-- gnome_manage_generic_home_content(thunderbird_t)
- ')
-
- optional_policy(`
diff --git a/fix_unconfined.patch b/fix_unconfined.patch
deleted file mode 100644
index 815055b..0000000
--- a/fix_unconfined.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-Index: fedora-policy-20221019/policy/modules/system/unconfined.te
-===================================================================
---- fedora-policy-20221019.orig/policy/modules/system/unconfined.te
-+++ fedora-policy-20221019/policy/modules/system/unconfined.te
-@@ -1,5 +1,10 @@
- policy_module(unconfined, 3.5.0)
-
-+require {
-+ type var_run_t;
-+ type net_conf_t;
-+}
-+
- ########################################
- #
- # Declarations
-@@ -45,3 +50,6 @@ optional_policy(`
- optional_policy(`
- container_runtime_domtrans(unconfined_service_t)
- ')
-+
-+filetrans_pattern(unconfined_service_t, var_run_t, net_conf_t, dir)
-+
diff --git a/fix_unconfineduser.patch b/fix_unconfineduser.patch
deleted file mode 100644
index bad300f..0000000
--- a/fix_unconfineduser.patch
+++ /dev/null
@@ -1,46 +0,0 @@
-Index: fedora-policy-20230206/policy/modules/roles/unconfineduser.te
-===================================================================
---- fedora-policy-20230206.orig/policy/modules/roles/unconfineduser.te
-+++ fedora-policy-20230206/policy/modules/roles/unconfineduser.te
-@@ -126,6 +126,11 @@ tunable_policy(`unconfined_dyntrans_all'
- domain_dyntrans(unconfined_t)
- ')
-
-+# FIXME this is probably caused by some wierd PAM interaction
-+corecmd_entrypoint_all_executables(unconfined_t)
-+# FIXME sddm JITs some code, requiring execmod on user_tmp_t. Check how to disable this behaviour in sddm/qtdeclarative
-+files_execmod_tmp(unconfined_t)
-+
- optional_policy(`
- gen_require(`
- type unconfined_t;
-@@ -216,6 +221,10 @@ optional_policy(`
- ')
-
- optional_policy(`
-+ cron_system_spool_entrypoint(unconfined_t)
-+')
-+
-+optional_policy(`
- chrome_role_notrans(unconfined_r, unconfined_t)
-
- tunable_policy(`unconfined_chrome_sandbox_transition',`
-@@ -250,6 +259,18 @@ optional_policy(`
- dbus_stub(unconfined_t)
-
- optional_policy(`
-+ accountsd_dbus_chat(unconfined_dbusd_t)
-+ ')
-+
-+ optional_policy(`
-+ networkmanager_dbus_chat(unconfined_dbusd_t)
-+ ')
-+
-+ optional_policy(`
-+ systemd_dbus_chat_logind(unconfined_dbusd_t)
-+ ')
-+
-+ optional_policy(`
- bluetooth_dbus_chat(unconfined_t)
- ')
-
diff --git a/fix_unprivuser.patch b/fix_unprivuser.patch
deleted file mode 100644
index 70fe21e..0000000
--- a/fix_unprivuser.patch
+++ /dev/null
@@ -1,18 +0,0 @@
-Index: fedora-policy-20221019/policy/modules/roles/unprivuser.te
-===================================================================
---- fedora-policy-20221019.orig/policy/modules/roles/unprivuser.te
-+++ fedora-policy-20221019/policy/modules/roles/unprivuser.te
-@@ -300,6 +300,13 @@ ifndef(`distro_redhat',`
- ')
-
- optional_policy(`
-+ rtorrent_role(user_r, user_t)
-+ # needed for tunable rtorrent_send_mails
-+ mta_role_access_system_mail(user_r)
-+')
-+
-+
-+optional_policy(`
- vmtools_run_helper(user_t, user_r)
- ')
-
diff --git a/fix_userdomain.patch b/fix_userdomain.patch
deleted file mode 100644
index a2ea637..0000000
--- a/fix_userdomain.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-Index: fedora-policy-20230116/policy/modules/system/userdomain.if
-===================================================================
---- fedora-policy-20230116.orig/policy/modules/system/userdomain.if
-+++ fedora-policy-20230116/policy/modules/system/userdomain.if
-@@ -1515,6 +1515,7 @@ tunable_policy(`deny_bluetooth',`',`
-
- # port access is audited even if dac would not have allowed it, so dontaudit it here
- # corenet_dontaudit_tcp_bind_all_reserved_ports($1_t)
-+ corenet_dontaudit_udp_bind_all_rpc_ports($1_t)
- # Need the following rule to allow users to run vpnc
- corenet_tcp_bind_xserver_port($1_t)
- corenet_tcp_bind_generic_node($1_usertype)
diff --git a/fix_usermanage.patch b/fix_usermanage.patch
deleted file mode 100644
index a7d1bee..0000000
--- a/fix_usermanage.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-Index: fedora-policy-20220428/policy/modules/admin/usermanage.te
-===================================================================
---- fedora-policy-20220428.orig/policy/modules/admin/usermanage.te
-+++ fedora-policy-20220428/policy/modules/admin/usermanage.te
-@@ -226,6 +226,7 @@ allow groupadd_t self:unix_dgram_socket
- allow groupadd_t self:unix_stream_socket create_stream_socket_perms;
- allow groupadd_t self:unix_dgram_socket sendto;
- allow groupadd_t self:unix_stream_socket connectto;
-+allow groupadd_t self:netlink_selinux_socket create_socket_perms;
-
- fs_getattr_xattr_fs(groupadd_t)
- fs_search_auto_mountpoints(groupadd_t)
-@@ -538,6 +539,7 @@ allow useradd_t self:unix_dgram_socket c
- allow useradd_t self:unix_stream_socket create_stream_socket_perms;
- allow useradd_t self:unix_dgram_socket sendto;
- allow useradd_t self:unix_stream_socket connectto;
-+allow useradd_t self:netlink_selinux_socket create_socket_perms;
-
- manage_dirs_pattern(useradd_t, useradd_var_run_t, useradd_var_run_t)
- manage_files_pattern(useradd_t, useradd_var_run_t, useradd_var_run_t)
-@@ -546,6 +548,8 @@ files_pid_filetrans(useradd_t, useradd_v
- # for getting the number of groups
- kernel_read_kernel_sysctls(useradd_t)
-
-+selinux_compute_access_vector(useradd_t)
-+
- corecmd_exec_shell(useradd_t)
- # Execute /usr/bin/{passwd,chfn,chsh} and /usr/sbin/{useradd,vipw}.
- corecmd_exec_bin(useradd_t)
diff --git a/fix_wine.patch b/fix_wine.patch
deleted file mode 100644
index 17698f2..0000000
--- a/fix_wine.patch
+++ /dev/null
@@ -1,23 +0,0 @@
-Index: fedora-policy-20220428/policy/modules/system/libraries.fc
-===================================================================
---- fedora-policy-20220428.orig/policy/modules/system/libraries.fc
-+++ fedora-policy-20220428/policy/modules/system/libraries.fc
-@@ -90,7 +90,7 @@ ifdef(`distro_redhat',`
- /opt/Adobe/Reader.?/Reader/intellinux/plug_ins/.*\.api -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /opt/Adobe/Reader.?/Reader/intellinux/SPPlugins/.*\.ap[il] -- gen_context(system_u:object_r:lib_t,s0)
- /opt/cisco-vpnclient/lib/libvpnapi\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
--/opt/cx.*/lib/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-+/opt/cx.*/lib/wine/.+\.(so|dll) -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /opt/f-secure/fspms/libexec/librapi\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /opt/ibm/java.*/jre/.+\.jar -- gen_context(system_u:object_r:lib_t,s0)
- /opt/ibm/java.*/jre/.+\.so(\.[^/]*)* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-@@ -173,7 +173,8 @@ ifdef(`distro_redhat',`
- /usr/lib/systemd/libsystemd-.+\.so.* -- gen_context(system_u:object_r:lib_t,s0)
-
- /usr/.*\.so(\.[^/]*)* -- gen_context(system_u:object_r:lib_t,s0)
--/usr/lib/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-+/usr/lib/wine/.+\.so -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-+/usr/lib/wine/*-windows/* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /usr/NX/lib/libXcomp\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
- /usr/NX/lib/libjpeg\.so.* -- gen_context(system_u:object_r:textrel_shlib_t,s0)
-
diff --git a/fix_xserver.patch b/fix_xserver.patch
deleted file mode 100644
index a8fd6e8..0000000
--- a/fix_xserver.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-Index: fedora-policy-20221019/policy/modules/services/xserver.fc
-===================================================================
---- fedora-policy-20221019.orig/policy/modules/services/xserver.fc
-+++ fedora-policy-20221019/policy/modules/services/xserver.fc
-@@ -71,6 +71,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
- /etc/X11/[wxg]dm/Xsession -- gen_context(system_u:object_r:xsession_exec_t,s0)
- /etc/X11/wdm(/.*)? gen_context(system_u:object_r:xdm_rw_etc_t,s0)
- /etc/X11/wdm/Xsetup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
-+/etc/X11/xdm/Xsetup -- gen_context(system_u:object_r:xsession_exec_t,s0)
- /etc/X11/wdm/Xstartup.* -- gen_context(system_u:object_r:xsession_exec_t,s0)
- /etc/X11/Xsession[^/]* -- gen_context(system_u:object_r:xsession_exec_t,s0)
-
-@@ -102,6 +103,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
-
- /usr/bin/sddm -- gen_context(system_u:object_r:xdm_exec_t,s0)
- /usr/bin/sddm-greeter -- gen_context(system_u:object_r:xdm_exec_t,s0)
-+/usr/lib/sddm/sddm-helper -- gen_context(system_u:object_r:xdm_exec_t,s0)
- /usr/bin/gpe-dm -- gen_context(system_u:object_r:xdm_exec_t,s0)
- /usr/bin/iceauth -- gen_context(system_u:object_r:iceauth_exec_t,s0)
- /usr/bin/razor-lightdm-.* -- gen_context(system_u:object_r:xdm_exec_t,s0)
-@@ -114,6 +116,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
- /usr/bin/Xwayland -- gen_context(system_u:object_r:xserver_exec_t,s0)
- /usr/bin/x11vnc -- gen_context(system_u:object_r:xserver_exec_t,s0)
- /usr/bin/nvidia.* -- gen_context(system_u:object_r:xserver_exec_t,s0)
-+/usr/bin/greetd -- gen_context(system_u:object_r:xdm_exec_t,s0)
-
- /usr/libexec/Xorg\.bin -- gen_context(system_u:object_r:xserver_exec_t,s0)
- /usr/libexec/Xorg\.wrap -- gen_context(system_u:object_r:xserver_exec_t,s0)
-@@ -137,6 +140,7 @@ HOME_DIR/\.dmrc.* -- gen_context(system_
- /usr/X11R6/lib/X11/xkb -d gen_context(system_u:object_r:xkb_var_lib_t,s0)
- /usr/X11R6/lib/X11/xkb/.* -- gen_context(system_u:object_r:xkb_var_lib_t,s0)
-
-+/usr/lib/X11/display-manager -- gen_context(system_u:object_r:xdm_exec_t,s0)
- ifndef(`distro_debian',`
- /usr/var/[xgkw]dm(/.*)? gen_context(system_u:object_r:xserver_log_t,s0)
- ')
-@@ -155,6 +159,7 @@ ifndef(`distro_debian',`
- /var/lib/[mxkwg]dm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
- /var/lib/xkb(/.*)? gen_context(system_u:object_r:xkb_var_lib_t,s0)
- /var/lib/xorg(/.*)? gen_context(system_u:object_r:xserver_var_lib_t,s0)
-+/var/lib/greetd(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
-
- /var/cache/lightdm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
- /var/cache/[mg]dm(/.*)? gen_context(system_u:object_r:xdm_var_lib_t,s0)
-@@ -184,6 +189,8 @@ ifndef(`distro_debian',`
- /var/run/xauth(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
- /var/run/xdmctl(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
- /var/run/sddm(/.*)? gen_context(system_u:object_r:xdm_var_run_t,s0)
-+/var/run/greetd[^/]*\.sock -s gen_context(system_u:object_r:xdm_var_run_t,s0)
-+/var/run/greetd\.run -- gen_context(system_u:object_r:xdm_var_run_t,s0)
-
- /var/run/video.rom -- gen_context(system_u:object_r:xserver_var_run_t,s0)
- /var/run/xorg(/.*)? gen_context(system_u:object_r:xserver_var_run_t,s0)
-Index: fedora-policy-20221019/policy/modules/services/xserver.te
-===================================================================
---- fedora-policy-20221019.orig/policy/modules/services/xserver.te
-+++ fedora-policy-20221019/policy/modules/services/xserver.te
-@@ -475,6 +475,10 @@ userdom_dontaudit_read_admin_home_lnk_fi
-
- kernel_read_vm_sysctls(xdm_t)
-
-+files_manage_generic_pids_symlinks(xdm_t)
-+userdom_manage_user_home_content_dirs(xdm_t)
-+userdom_manage_user_home_content_files(xdm_t)
-+
- # Allow gdm to run gdm-binary
- can_exec(xdm_t, xdm_exec_t)
- can_exec(xdm_t, xsession_exec_t)
diff --git a/packagekit.fc b/packagekit.fc
deleted file mode 100644
index b004ae0..0000000
--- a/packagekit.fc
+++ /dev/null
@@ -1,44 +0,0 @@
-/usr/lib/systemd/system/packagekit.* -- gen_context(system_u:object_r:packagekit_unit_file_t,s0)
-
-/usr/bin/packagekit -- gen_context(system_u:object_r:packagekit_exec_t,s0)
-
-#/var/lib/PackageKit(/.*)? gen_context(system_u:object_r:packagekit_var_lib_t,s0)
-
-/usr/bin/pkcon -- gen_context(system_u:object_r:packagekit_exec_t,s0)
-/usr/bin/pkmon -- gen_context(system_u:object_r:packagekit_exec_t,s0)
-/usr/lib/packagekit-direct -- gen_context(system_u:object_r:packagekit_exec_t,s0)
-/usr/lib/packagekitd -- gen_context(system_u:object_r:packagekit_exec_t,s0)
-/usr/lib/pk-offline-update -- gen_context(system_u:object_r:packagekit_exec_t,s0)
-
-#/etc/PackageKit
-#/etc/dbus-1/system.d/org.freedesktop.PackageKit.conf
-#/usr/lib/tmpfiles.d
-#/usr/lib/tmpfiles.d/PackageKit.conf
-#/usr/lib64/packagekit-backend
-#/usr/lib64/packagekit-backend/libpk_backend_dummy.so
-#/usr/sbin/rcpackagekit
-#/usr/sbin/rcpackagekit-offline-update
-#/usr/share/PackageKit
-#/usr/share/PackageKit/helpers
-#/usr/share/PackageKit/helpers/test_spawn
-#/usr/share/PackageKit/helpers/test_spawn/search-name.sh
-#/usr/share/PackageKit/packagekit-background.sh
-#/usr/share/PackageKit/pk-upgrade-distro.sh
-#/usr/share/PackageKit/transactions.db
-#/usr/share/bash-completion/completions/pkcon
-#/usr/share/dbus-1/interfaces/org.freedesktop.PackageKit.Transaction.xml
-#/usr/share/dbus-1/interfaces/org.freedesktop.PackageKit.xml
-#/usr/share/dbus-1/system-services/org.freedesktop.PackageKit.service
-#/usr/share/doc/packages/PackageKit
-#/usr/share/doc/packages/PackageKit/AUTHORS
-#/usr/share/doc/packages/PackageKit/HACKING
-#/usr/share/doc/packages/PackageKit/NEWS
-#/usr/share/doc/packages/PackageKit/README
-#/usr/share/doc/packages/PackageKit/org.freedesktop.packagekit.rules
-#/usr/share/licenses/PackageKit
-#/usr/share/licenses/PackageKit/COPYING
-#/usr/share/man/man1/pkcon.1.gz
-#/usr/share/man/man1/pkmon.1.gz
-#/usr/share/polkit-1/actions/org.freedesktop.packagekit.policy
-#/var/cache/PackageKit
-
diff --git a/packagekit.if b/packagekit.if
deleted file mode 100644
index a9d1918..0000000
--- a/packagekit.if
+++ /dev/null
@@ -1,40 +0,0 @@
-## A temporary policy for packagekit.
-
-########################################
-##
-## Allow reading of fifo files
-##
-##
-##
-## Domain allowed to mange files
-##
-##
-#
-interface(`packagekit_read_write_fifo',`
- gen_require(`
- type packagekit_t;
- ')
-
- allow $1 packagekit_t:fifo_file rw_inherited_fifo_file_perms;
-')
-
-########################################
-##
-## Send and receive messages from
-## packagekit over dbus.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`packagekit_dbus_chat',`
- gen_require(`
- type packagekit_t;
- class dbus send_msg;
- ')
-
- allow $1 packagekit_t:dbus send_msg;
- allow packagekit_t $1:dbus send_msg;
-')
diff --git a/packagekit.te b/packagekit.te
deleted file mode 100644
index 090ccb7..0000000
--- a/packagekit.te
+++ /dev/null
@@ -1,38 +0,0 @@
-policy_module(packagekit,1.0.0)
-
-########################################
-#
-# Declarations
-#
-
-type packagekit_t;
-type packagekit_exec_t;
-init_daemon_domain(packagekit_t,packagekit_exec_t)
-
-type packagekit_unit_file_t;
-systemd_unit_file(packagekit_unit_file_t)
-
-type packagekit_var_lib_t;
-files_type(packagekit_var_lib_t)
-
-unconfined_dbus_chat(packagekit_t)
-init_dbus_chat(packagekit_t)
-optional_policy(`
- policykit_dbus_chat(packagekit_t)
-')
-
-optional_policy(`
- unconfined_domain(packagekit_t)
-')
-
-optional_policy(`
- snapper_dbus_chat(packagekit_t)
-')
-
-optional_policy(`
- systemd_dbus_chat_logind(packagekit_t)
-')
-
-optional_policy(`
- rpm_transition_script(packagekit_t,system_r)
-')
diff --git a/rebootmgr.fc b/rebootmgr.fc
deleted file mode 100644
index 156f78f..0000000
--- a/rebootmgr.fc
+++ /dev/null
@@ -1 +0,0 @@
-/usr/sbin/rebootmgrd -- gen_context(system_u:object_r:rebootmgr_exec_t,s0)
diff --git a/rebootmgr.if b/rebootmgr.if
deleted file mode 100644
index bb42f80..0000000
--- a/rebootmgr.if
+++ /dev/null
@@ -1,61 +0,0 @@
-
-## policy for rebootmgr
-
-########################################
-##
-## Execute rebootmgr_exec_t in the rebootmgr domain.
-##
-##
-##
-## Domain allowed to transition.
-##
-##
-#
-interface(`rebootmgr_domtrans',`
- gen_require(`
- type rebootmgr_t, rebootmgr_exec_t;
- ')
-
- corecmd_search_bin($1)
- domtrans_pattern($1, rebootmgr_exec_t, rebootmgr_t)
-')
-
-######################################
-##
-## Execute rebootmgr in the caller domain.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`rebootmgr_exec',`
- gen_require(`
- type rebootmgr_exec_t;
- ')
-
- corecmd_search_bin($1)
- can_exec($1, rebootmgr_exec_t)
-')
-
-########################################
-##
-## Send and receive messages from
-## rebootmgr over dbus.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`rebootmgr_dbus_chat',`
- gen_require(`
- type rebootmgr_t;
- class dbus send_msg;
- ')
-
- allow $1 rebootmgr_t:dbus send_msg;
- allow rebootmgr_t $1:dbus send_msg;
-')
diff --git a/rebootmgr.te b/rebootmgr.te
deleted file mode 100644
index 4b4e6ab..0000000
--- a/rebootmgr.te
+++ /dev/null
@@ -1,37 +0,0 @@
-policy_module(rebootmgr, 1.0.0)
-
-########################################
-#
-# Declarations
-#
-
-type rebootmgr_t;
-type rebootmgr_exec_t;
-init_daemon_domain(rebootmgr_t, rebootmgr_exec_t)
-
-########################################
-#
-# rebootmgr local policy
-#
-allow rebootmgr_t self:process { fork };
-allow rebootmgr_t self:fifo_file rw_fifo_file_perms;
-allow rebootmgr_t self:unix_stream_socket create_stream_socket_perms;
-
-domain_use_interactive_fds(rebootmgr_t)
-
-files_manage_etc_files(rebootmgr_t)
-
-logging_send_syslog_msg(rebootmgr_t)
-
-miscfiles_read_localization(rebootmgr_t)
-
-systemd_start_power_services(rebootmgr_t)
-
-systemd_dbus_chat_logind(rebootmgr_t)
-
-unconfined_dbus_chat(rebootmgr_t)
-
-optional_policy(`
- dbus_system_bus_client(rebootmgr_t)
- dbus_connect_system_bus(rebootmgr_t)
-')
diff --git a/rtorrent.fc b/rtorrent.fc
deleted file mode 100644
index 562f8ad..0000000
--- a/rtorrent.fc
+++ /dev/null
@@ -1 +0,0 @@
-/usr/bin/rtorrent -- gen_context(system_u:object_r:rtorrent_exec_t,s0)
diff --git a/rtorrent.if b/rtorrent.if
deleted file mode 100644
index 9ea4193..0000000
--- a/rtorrent.if
+++ /dev/null
@@ -1,95 +0,0 @@
-
-## policy for rtorrent
-
-########################################
-##
-## Execute rtorrent_exec_t in the rtorrent domain.
-##
-##
-##
-## Domain allowed to transition.
-##
-##
-#
-interface(`rtorrent_domtrans',`
- gen_require(`
- type rtorrent_t, rtorrent_exec_t;
- ')
-
- corecmd_search_bin($1)
- domtrans_pattern($1, rtorrent_exec_t, rtorrent_t)
-')
-
-######################################
-##
-## Execute rtorrent in the caller domain.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`rtorrent_exec',`
- gen_require(`
- type rtorrent_exec_t;
- ')
-
- corecmd_search_bin($1)
- can_exec($1, rtorrent_exec_t)
-')
-
-########################################
-##
-## Execute rtorrent in the rtorrent domain, and
-## allow the specified role the rtorrent domain.
-##
-##
-##
-## Domain allowed to transition
-##
-##
-##
-##
-## The role to be allowed the rtorrent domain.
-##
-##
-#
-interface(`rtorrent_run',`
- gen_require(`
- type rtorrent_t;
- attribute_role rtorrent_roles;
- ')
-
- rtorrent_domtrans($1)
- roleattribute $2 rtorrent_roles;
-')
-
-########################################
-##
-## Role access for rtorrent
-##
-##
-##
-## Role allowed access
-##
-##
-##
-##
-## User domain for the role
-##
-##
-#
-interface(`rtorrent_role',`
- gen_require(`
- type rtorrent_t;
- attribute_role rtorrent_roles;
- ')
-
- roleattribute $1 rtorrent_roles;
-
- rtorrent_domtrans($2)
-
- ps_process_pattern($2, rtorrent_t)
- allow $2 rtorrent_t:process { signull signal sigkill };
-')
diff --git a/rtorrent.te b/rtorrent.te
deleted file mode 100644
index 996f7a7..0000000
--- a/rtorrent.te
+++ /dev/null
@@ -1,101 +0,0 @@
-policy_module(rtorrent, 1.0.0)
-
-########################################
-#
-# Declarations
-#
-##
-##
-## Allow rtorrent to use send mails
-##
-##
-gen_tunable(rtorrent_send_mails, false)
-
-##
-##
-## Enable necessary permissions for rutorrent
-##
-##
-gen_tunable(rtorrent_enable_rutorrent, false)
-
-##
-##
-## Allow rtorrent to execute helper scripts in home directories
-##
-##
-gen_tunable(rtorrent_exec_scripts, false)
-
-attribute_role rtorrent_roles;
-roleattribute system_r rtorrent_roles;
-
-type rtorrent_t;
-type rtorrent_exec_t;
-application_domain(rtorrent_t, rtorrent_exec_t)
-role rtorrent_roles types rtorrent_t;
-
-########################################
-#
-# rtorrent local policy
-#
-allow rtorrent_t self:process { fork signal_perms };
-
-allow rtorrent_t self:fifo_file manage_fifo_file_perms;
-allow rtorrent_t self:unix_stream_socket create_stream_socket_perms;
-
-domain_use_interactive_fds(rtorrent_t)
-
-files_read_etc_files(rtorrent_t)
-
-miscfiles_read_localization(rtorrent_t)
-
-sysnet_dns_name_resolve(rtorrent_t)
-
-optional_policy(`
- gen_require(`
- type staff_t;
- role staff_r;
- ')
-
- rtorrent_run(staff_t, staff_r)
-')
-
-type rtorrent_port_t;
-corenet_port(rtorrent_port_t)
-allow rtorrent_t rtorrent_port_t:tcp_socket name_bind;
-
-userdom_read_user_home_content_symlinks(rtorrent_t)
-userdom_manage_user_home_content_files(rtorrent_t)
-userdom_manage_user_home_content_dirs(rtorrent_t)
-
-allow rtorrent_t self:tcp_socket { accept listen };
-
-corenet_tcp_connect_all_ports(rtorrent_t)
-
-fs_getattr_xattr_fs(rtorrent_t)
-
-userdom_use_inherited_user_terminals(rtorrent_t)
-# this might be to much
-userdom_home_manager(rtorrent_t)
-userdom_filetrans_home_content(rtorrent_t)
-
-optional_policy(`
- tunable_policy(`rtorrent_send_mails',`
- userdom_exec_user_bin_files(rtorrent_t)
- userdom_exec_user_home_content_files(rtorrent_t)
- files_manage_generic_tmp_files(rtorrent_t)
- mta_send_mail(rtorrent_t)
- ')
-')
-
-optional_policy(`
- tunable_policy(`rtorrent_enable_rutorrent',`
- apache_manage_sys_content(rtorrent_t)
- apache_exec_sys_content(rtorrent_t)
- ')
-')
-
-tunable_policy(`rtorrent_exec_scripts',`
- # execute helper scripts
- corecmd_exec_bin(rtorrent_t)
- userdom_exec_user_bin_files(rtorrent_t)
-')
diff --git a/sedoctool.patch b/sedoctool.patch
deleted file mode 100644
index 82b2eee..0000000
--- a/sedoctool.patch
+++ /dev/null
@@ -1,22 +0,0 @@
-Index: fedora-policy/support/sedoctool.py
-===================================================================
---- fedora-policy.orig/support/sedoctool.py
-+++ fedora-policy/support/sedoctool.py
-@@ -810,7 +810,7 @@ if booleans:
- namevalue_list = []
- if os.path.exists(booleans):
- try:
-- conf = open(booleans, 'r')
-+ conf = open(booleans, 'r', errors='replace')
- except:
- error("Could not open booleans file for reading")
-
-@@ -831,7 +831,7 @@ if modules:
- namevalue_list = []
- if os.path.exists(modules):
- try:
-- conf = open(modules, 'r')
-+ conf = open(modules, 'r', errors='replace')
- except:
- error("Could not open modules file for reading")
- namevalue_list = get_conf(conf)
diff --git a/selinux-policy-20230214.tar.xz b/selinux-policy-20230214.tar.xz
new file mode 100644
index 0000000..a99d60c
--- /dev/null
+++ b/selinux-policy-20230214.tar.xz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:9693ed2c5547a04fe58227ee5f6db761b68cc2f4c7267492220e33678788a83f
+size 752564
diff --git a/selinux-policy.changes b/selinux-policy.changes
index c83b5af..2656fda 100644
--- a/selinux-policy.changes
+++ b/selinux-policy.changes
@@ -1,3 +1,90 @@
+-------------------------------------------------------------------
+Tue Feb 14 21:41:54 UTC 2023 - Hu
+
+- Complete packaging rework: Move policy to git repository and
+ only use tar_scm obs service to refresh from there:
+ https://gitlab.suse.de/selinux/selinux-policy
+
+ Please use `osc service manualrun` to update this OBS package to the
+ newest git version.
+
+ * Added README.Update describing how to update this package
+ * Added _service file that pulls from selinux-policy and
+ upstream container-selinux and tars them
+ * Adapted selinux-policy.spec to build selinux-policy with
+ container-selinux
+ * Removed update.sh as no longer needed
+ * Removed suse specific modules as they are now covered by git commits
+ * packagekit.te packagekit.if packagekit.fc
+ * rebootmgr.te rebootmgr.if rebootmgr.fc
+ * rtorrent.te rtorrent.if rtorrent.fc
+ * wicked.te wicked.if wicked.fc
+ * Removed *.patch as they are now covered by git commits:
+ * distro_suse_to_distro_redhat.patch
+ * dontaudit_interface_kmod_tmpfs.patch
+ * fix_accountsd.patch
+ * fix_alsa.patch
+ * fix_apache.patch
+ * fix_auditd.patch
+ * fix_authlogin.patch
+ * fix_automount.patch
+ * fix_bitlbee.patch
+ * fix_chronyd.patch
+ * fix_cloudform.patch
+ * fix_colord.patch
+ * fix_corecommand.patch
+ * fix_cron.patch
+ * fix_dbus.patch
+ * fix_djbdns.patch
+ * fix_dnsmasq.patch
+ * fix_dovecot.patch
+ * fix_entropyd.patch
+ * fix_firewalld.patch
+ * fix_fwupd.patch
+ * fix_geoclue.patch
+ * fix_hypervkvp.patch
+ * fix_init.patch
+ * fix_ipsec.patch
+ * fix_iptables.patch
+ * fix_irqbalance.patch
+ * fix_java.patch
+ * fix_kernel.patch
+ * fix_kernel_sysctl.patch
+ * fix_libraries.patch
+ * fix_locallogin.patch
+ * fix_logging.patch
+ * fix_logrotate.patch
+ * fix_mcelog.patch
+ * fix_miscfiles.patch
+ * fix_nagios.patch
+ * fix_networkmanager.patch
+ * fix_nis.patch
+ * fix_nscd.patch
+ * fix_ntp.patch
+ * fix_openvpn.patch
+ * fix_postfix.patch
+ * fix_rpm.patch
+ * fix_rtkit.patch
+ * fix_screen.patch
+ * fix_selinuxutil.patch
+ * fix_sendmail.patch
+ * fix_smartmon.patch
+ * fix_snapper.patch
+ * fix_sslh.patch
+ * fix_sysnetwork.patch
+ * fix_systemd.patch
+ * fix_systemd_watch.patch
+ * fix_thunderbird.patch
+ * fix_unconfined.patch
+ * fix_unconfineduser.patch
+ * fix_unprivuser.patch
+ * fix_userdomain.patch
+ * fix_usermanage.patch
+ * fix_wine.patch
+ * fix_xserver.patch
+ * sedoctool.patch
+ * systemd_domain_dyntrans_type.patch
+
-------------------------------------------------------------------
Mon Feb 6 08:36:32 UTC 2023 - Johannes Segitz
diff --git a/selinux-policy.spec b/selinux-policy.spec
index 11acb6d..80d04ff 100644
--- a/selinux-policy.spec
+++ b/selinux-policy.spec
@@ -33,10 +33,11 @@ Summary: SELinux policy configuration
License: GPL-2.0-or-later
Group: System/Management
Name: selinux-policy
-Version: 20230206
+Version: 20230214
Release: 0
-Source: fedora-policy-%{version}.tar.bz2
-Source1: selinux-policy-rpmlintrc
+Source0: %{name}-%{version}.tar.xz
+Source1: container-selinux-%{version}.tar.xz
+Source2: selinux-policy-rpmlintrc
Source10: modules-targeted-base.conf
Source11: modules-targeted-contrib.conf
@@ -70,89 +71,6 @@ Source92: customizable_types
#Source93: config.tgz
Source94: file_contexts.subs_dist
Source95: macros.selinux-policy
-Source96: update.sh
-
-Source120: packagekit.te
-Source121: packagekit.if
-Source122: packagekit.fc
-Source123: rtorrent.te
-Source124: rtorrent.if
-Source125: rtorrent.fc
-Source126: wicked.te
-Source127: wicked.if
-Source128: wicked.fc
-Source129: rebootmgr.te
-Source130: rebootmgr.if
-Source131: rebootmgr.fc
-
-Patch000: distro_suse_to_distro_redhat.patch
-Patch001: fix_djbdns.patch
-Patch002: fix_dbus.patch
-Patch004: fix_java.patch
-Patch006: fix_thunderbird.patch
-Patch007: fix_postfix.patch
-Patch008: fix_nscd.patch
-Patch009: fix_sysnetwork.patch
-Patch010: fix_logging.patch
-Patch011: fix_xserver.patch
-Patch012: fix_miscfiles.patch
-Patch013: fix_init.patch
-Patch014: fix_locallogin.patch
-Patch016: fix_iptables.patch
-Patch017: fix_irqbalance.patch
-Patch018: fix_ntp.patch
-Patch019: fix_fwupd.patch
-Patch020: fix_firewalld.patch
-Patch021: fix_logrotate.patch
-Patch022: fix_selinuxutil.patch
-Patch024: fix_corecommand.patch
-Patch025: fix_snapper.patch
-Patch026: fix_systemd.patch
-Patch027: fix_unconfined.patch
-Patch028: fix_unconfineduser.patch
-Patch029: fix_chronyd.patch
-Patch030: fix_networkmanager.patch
-Patch032: fix_accountsd.patch
-Patch033: fix_automount.patch
-Patch034: fix_colord.patch
-Patch035: fix_mcelog.patch
-Patch036: fix_sslh.patch
-Patch037: fix_nagios.patch
-Patch038: fix_openvpn.patch
-Patch039: fix_cron.patch
-Patch040: fix_usermanage.patch
-Patch041: fix_smartmon.patch
-Patch042: fix_geoclue.patch
-Patch044: fix_authlogin.patch
-Patch045: fix_screen.patch
-Patch046: fix_unprivuser.patch
-Patch047: fix_rpm.patch
-Patch048: fix_apache.patch
-Patch049: fix_nis.patch
-Patch050: fix_libraries.patch
-Patch051: fix_dovecot.patch
-# https://github.com/cockpit-project/cockpit/pull/15758
-#Patch052: fix_cockpit.patch
-Patch053: fix_systemd_watch.patch
-# kernel specific sysctl.conf (boo#1184804)
-Patch054: fix_kernel_sysctl.patch
-Patch055: fix_auditd.patch
-Patch056: fix_wine.patch
-Patch057: fix_hypervkvp.patch
-Patch058: fix_bitlbee.patch
-Patch059: systemd_domain_dyntrans_type.patch
-Patch060: fix_dnsmasq.patch
-Patch061: fix_userdomain.patch
-Patch062: fix_cloudform.patch
-Patch063: fix_alsa.patch
-Patch064: dontaudit_interface_kmod_tmpfs.patch
-Patch065: fix_sendmail.patch
-Patch066: fix_ipsec.patch
-Patch067: fix_kernel.patch
-Patch068: fix_entropyd.patch
-Patch069: fix_rtkit.patch
-
-Patch100: sedoctool.patch
URL: https://github.com/fedora-selinux/selinux-policy.git
BuildRoot: %{_tmppath}/%{name}-%{version}-build
@@ -413,7 +331,16 @@ fi;
exit 0
%prep
-%autosetup -n fedora-policy-%{version} -p1
+
+# set up selinux-policy
+%autosetup -n %{name}-%{version} -p1
+
+# dirty hack for container-selinux, because selinux-policy won't build without it
+# upstream does not want to include it in main policy tree:
+# see discussion in https://github.com/containers/container-selinux/issues/186
+%setup -T -D -b 1
+cp ../container-selinux-%{version}/container.* policy/modules/services/
+rm -rf ../container-selinux-%{version}
%build
@@ -440,10 +367,6 @@ for i in %{SOURCE10} %{SOURCE11} %{SOURCE12} %{SOURCE13} %{SOURCE14} %{SOURCE15}
cp $i selinux_config
done
-for i in %{SOURCE120} %{SOURCE121} %{SOURCE122} %{SOURCE123} %{SOURCE124} %{SOURCE125} %{SOURCE126} %{SOURCE127} %{SOURCE128} %{SOURCE129} %{SOURCE130} %{SOURCE131}; do
- cp $i policy/modules/contrib
-done
-
make clean
%if %{BUILD_TARGETED}
%makeCmds targeted mcs allow
diff --git a/systemd_domain_dyntrans_type.patch b/systemd_domain_dyntrans_type.patch
deleted file mode 100644
index 8376c95..0000000
--- a/systemd_domain_dyntrans_type.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-Index: fedora-policy-20220124/policy/modules/system/init.te
-===================================================================
---- fedora-policy-20220124.orig/policy/modules/system/init.te
-+++ fedora-policy-20220124/policy/modules/system/init.te
-@@ -179,6 +179,8 @@ allow init_t self:tcp_socket { listen ac
- allow init_t self:packet_socket create_socket_perms;
- allow init_t self:key manage_key_perms;
- allow init_t self:bpf { map_create map_read map_write prog_load prog_run };
-+domain_dyntrans_type(init_t)
-+allow init_t self:process { dyntransition setcurrent };
-
- # is ~sys_module really needed? observed:
- # sys_boot
diff --git a/update.sh b/update.sh
deleted file mode 100644
index 92f709c..0000000
--- a/update.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/sh
-
-date=$(date '+%Y%m%d')
-
-echo Update to $date
-
-rm -rf fedora-policy container-selinux
-
-git clone --depth 1 https://github.com/fedora-selinux/selinux-policy.git
-git clone --depth 1 https://github.com/containers/container-selinux.git
-
-mv selinux-policy fedora-policy-$date
-rm -rf fedora-policy-$date/.git*
-mv container-selinux/container.* fedora-policy-$date/policy/modules/services/
-
-rm -f fedora-policy?$date.tar*
-tar cf fedora-policy-$date.tar fedora-policy-$date
-bzip2 fedora-policy-$date.tar
-rm -rf fedora-policy-$date container-selinux
-
-sed -i -e "s/^Version:.*/Version: $date/" selinux-policy.spec
-
-echo "remove old tar file, then osc addremove"
diff --git a/wicked.fc b/wicked.fc
deleted file mode 100644
index 8b84838..0000000
--- a/wicked.fc
+++ /dev/null
@@ -1,50 +0,0 @@
-# not used
-#/etc/wicked/dispatcher\.d(/.*)? gen_context(system_u:object_r:wicked_initrc_exec_t,s0)
-#/usr/lib/wicked/dispatcher\.d(/.*)? gen_context(system_u:object_r:wicked_initrc_exec_t,s0)
-
-/etc/wicked(/.*)? gen_context(system_u:object_r:wicked_etc_t,s0)
-/etc/wicked/extensions/.* -- gen_context(system_u:object_r:wicked_exec_t,s0)
-
-#/etc/wicked/wicked\.conf gen_context(system_u:object_r:wicked_etc_rw_t,s0)
-#/etc/wicd/wired-settings.conf -- gen_context(system_u:object_r:wicked_var_lib_t, s0)
-
-/usr/lib/systemd/system/wicked.* -- gen_context(system_u:object_r:wicked_unit_file_t,s0)
-
-/sbin/ifdown -- gen_context(system_u:object_r:wicked_exec_t,s0)
-/sbin/ifprobe -- gen_context(system_u:object_r:wicked_exec_t,s0)
-/sbin/ifstatus -- gen_context(system_u:object_r:wicked_exec_t,s0)
-/sbin/ifup -- gen_context(system_u:object_r:wicked_exec_t,s0)
-/usr/sbin/ifup -- gen_context(system_u:object_r:wicked_exec_t,s0)
-
-/usr/sbin/rcwicked.* -- gen_context(system_u:object_r:wicked_initrc_exec_t,s0)
-
-/usr/lib/wicked/bin(/.*)? gen_context(system_u:object_r:wicked_exec_t,s0)
-/usr/libexec/wicked/bin(/.*)? gen_context(system_u:object_r:wicked_exec_t,s0)
-
-#/usr/lib64/libwicked-0.6.63.so
-
-/usr/sbin/wicked -- gen_context(system_u:object_r:wicked_exec_t,s0)
-/usr/sbin/wickedd -- gen_context(system_u:object_r:wicked_exec_t,s0)
-/usr/sbin/wickedd-nanny -- gen_context(system_u:object_r:wicked_exec_t,s0)
-#/usr/share/wicked/schema/wireless.xml
-/var/lib/wicked(/.*)? gen_context(system_u:object_r:wicked_var_lib_t,s0)
-#/etc/sysconfig/network/ifcfg-lo
-
-#/usr/sbin/wpa_cli -- gen_context(system_u:object_r:wpa_cli_exec_t,s0)
-#/usr/bin/wpa_supplicant -- gen_context(system_u:object_r:wicked_exec_t,s0)
-#/var/lib/wicd(/.*)? gen_context(system_u:object_r:wicked_var_lib_t,s0)
-#/var/log/wicd.* -- gen_context(system_u:object_r:wicked_log_t,s0)
-
-/var/run/wicked(/.*)? gen_context(system_u:object_r:wicked_var_run_t,s0)
-
-#/etc/dbus-1
-#/etc/dbus-1/system.d
-#/etc/dbus-1/system.d/org.opensuse.Network.AUTO4.conf
-#/etc/dbus-1/system.d/org.opensuse.Network.DHCP4.conf
-#/etc/dbus-1/system.d/org.opensuse.Network.DHCP6.conf
-#/etc/dbus-1/system.d/org.opensuse.Network.Nanny.conf
-#/etc/dbus-1/system.d/org.opensuse.Network.conf
-
-/etc/sysconfig/network/scripts(/.*)? gen_context(system_u:object_r:wicked_script_t,s0)
-/etc/sysconfig/network/scripts/samba-winbindd -- gen_context(system_u:object_r:wicked_winbind_script_t,s0)
-/etc/sysconfig/network/scripts/dhcpd-restart-hook -- gen_context(system_u:object_r:wicked_dhcp_script_t,s0)
diff --git a/wicked.if b/wicked.if
deleted file mode 100644
index 0246cda..0000000
--- a/wicked.if
+++ /dev/null
@@ -1,678 +0,0 @@
-## Manager for dynamically switching between networks.
-
-########################################
-##
-## Read and write wicked UDP sockets.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-# cjp: added for named.
-interface(`wicked_rw_udp_sockets',`
- gen_require(`
- type wicked_t;
- ')
-
- allow $1 wicked_t:udp_socket { read write };
-')
-
-########################################
-##
-## Read and write wicked packet sockets.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-# cjp: added for named.
-interface(`wicked_rw_packet_sockets',`
- gen_require(`
- type wicked_t;
- ')
-
- allow $1 wicked_t:packet_socket { read write };
-')
-
-#######################################
-##
-## Allow caller to relabel tun_socket
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_attach_tun_iface',`
- gen_require(`
- type wicked_t;
- ')
-
- allow $1 wicked_t:tun_socket relabelfrom;
- allow $1 self:tun_socket relabelto;
-')
-
-########################################
-##
-## Read and write wicked netlink
-## routing sockets.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-# cjp: added for named.
-interface(`wicked_rw_routing_sockets',`
- gen_require(`
- type wicked_t;
- ')
-
- allow $1 wicked_t:netlink_route_socket { read write };
-')
-
-########################################
-##
-## Execute wicked with a domain transition.
-##
-##
-##
-## Domain allowed to transition.
-##
-##
-#
-interface(`wicked_domtrans',`
- gen_require(`
- type wicked_t, wicked_exec_t;
- ')
-
- corecmd_search_bin($1)
- domtrans_pattern($1, wicked_exec_t, wicked_t)
-')
-
-#######################################
-##
-## Execute wicked scripts with an automatic domain transition to initrc.
-##
-##
-##
-## Domain allowed to transition.
-##
-##
-#
-interface(`wicked_initrc_domtrans',`
- gen_require(`
- type wicked_initrc_exec_t;
- ')
-
- init_labeled_script_domtrans($1, wicked_initrc_exec_t)
-')
-
-#######################################
-##
-## Allow reading of wicked link files
-##
-##
-##
-## Domain allowed to read the links
-##
-##
-#
-interface(`wicked_initrc_read_lnk_files',`
- gen_require(`
- type wicked_initrc_exec_t;
- ')
-
- read_lnk_files_pattern($1, wicked_initrc_exec_t, wicked_initrc_exec_t)
-')
-
-########################################
-##
-## Execute wicked server in the wicked domain.
-##
-##
-##
-## Domain allowed to transition.
-##
-##
-#
-interface(`wicked_systemctl',`
- gen_require(`
- type wicked_unit_file_t;
- type wicked_t;
- ')
-
- systemd_exec_systemctl($1)
- init_reload_services($1)
- allow $1 wicked_unit_file_t:file read_file_perms;
- allow $1 wicked_unit_file_t:service manage_service_perms;
-
- ps_process_pattern($1, wicked_t)
-')
-
-########################################
-##
-## Send and receive messages from
-## wicked over dbus.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_dbus_chat',`
- gen_require(`
- type wicked_t;
- class dbus send_msg;
- ')
-
- allow $1 wicked_t:dbus send_msg;
- allow wicked_t $1:dbus send_msg;
-')
-
-#######################################
-##
-## Read metworkmanager process state files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_read_state',`
- gen_require(`
- type wicked_t;
- ')
-
- allow $1 wicked_t:dir search_dir_perms;
- allow $1 wicked_t:file read_file_perms;
- allow $1 wicked_t:lnk_file read_lnk_file_perms;
-')
-
-########################################
-##
-## Do not audit attempts to send and
-## receive messages from wicked
-## over dbus.
-##
-##
-##
-## Domain to not audit.
-##
-##
-#
-interface(`wicked_dontaudit_dbus_chat',`
- gen_require(`
- type wicked_t;
- class dbus send_msg;
- ')
-
- dontaudit $1 wicked_t:dbus send_msg;
- dontaudit wicked_t $1:dbus send_msg;
-')
-
-########################################
-##
-## Send a generic signal to wicked
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_signal',`
- gen_require(`
- type wicked_t;
- ')
-
- allow $1 wicked_t:process signal;
-')
-
-########################################
-##
-## Create, read, and write
-## wicked library files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_manage_lib_files',`
- gen_require(`
- type wicked_var_lib_t;
- ')
-
- files_search_var_lib($1)
- manage_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
- allow $1 wicked_var_lib_t:file map;
-')
-
-########################################
-##
-## Read wicked lib files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_read_lib_files',`
- gen_require(`
- type wicked_var_lib_t;
- ')
-
- files_search_var_lib($1)
- list_dirs_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
- read_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
- allow $1 wicked_var_lib_t:file map;
-')
-
-#######################################
-##
-## Read wicked conf files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_read_conf',`
- gen_require(`
- type wicked_etc_t;
- type wicked_etc_rw_t;
- ')
-
- allow $1 wicked_etc_t:dir list_dir_perms;
- read_files_pattern($1,wicked_etc_t,wicked_etc_t)
- read_files_pattern($1,wicked_etc_rw_t,wicked_etc_rw_t)
-')
-
-########################################
-##
-## Read wicked PID files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_read_pid_files',`
- gen_require(`
- type wicked_var_run_t;
- ')
-
- files_search_pids($1)
- read_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
-')
-
-########################################
-##
-## Manage wicked PID files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_manage_pid_files',`
- gen_require(`
- type wicked_var_run_t;
- ')
-
- files_search_pids($1)
- manage_dirs_pattern($1, wicked_var_run_t, wicked_var_run_t)
- manage_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
-')
-
-########################################
-##
-## Manage wicked PID sock files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_manage_pid_sock_files',`
- gen_require(`
- type wicked_var_run_t;
- ')
-
- files_search_pids($1)
- manage_sock_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
-')
-
-########################################
-##
-## Create objects in /etc with a private
-## type using a type_transition.
-##
-##
-##
-## Domain allowed access.
-##
-##
-##
-##
-## Private file type.
-##
-##
-##
-##
-## Object classes to be created.
-##
-##
-##
-##
-## The name of the object being created.
-##
-##
-#
-interface(`wicked_pid_filetrans',`
- gen_require(`
- type wicked_var_run_t;
- ')
-
- filetrans_pattern($1, wicked_var_run_t, $2, $3, $4)
-')
-
-####################################
-##
-## Connect to wicked over
-## a unix domain stream socket.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_stream_connect',`
- gen_require(`
- type wicked_t, wicked_var_run_t;
- ')
-
- files_search_pids($1)
- stream_connect_pattern($1, wicked_var_run_t, wicked_var_run_t, wicked_t)
-')
-
-########################################
-##
-## Delete wicked PID files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_delete_pid_files',`
- gen_require(`
- type wicked_var_run_t;
- ')
-
- files_search_pids($1)
- delete_files_pattern($1, wicked_var_run_t, wicked_var_run_t)
-')
-
-########################################
-##
-## Execute wicked in the wicked domain, and
-## allow the specified role the wicked domain.
-##
-##
-##
-## Domain allowed to transition.
-##
-##
-##
-##
-## Role allowed access.
-##
-##
-##
-#
-interface(`wicked_run',`
- gen_require(`
- type wicked_t, wicked_exec_t;
- ')
-
- wicked_domtrans($1)
- role $2 types wicked_t;
-')
-
-########################################
-##
-## Allow the specified domain to append
-## to Network Manager log files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_append_log',`
- gen_require(`
- type wicked_log_t;
- ')
-
- logging_search_logs($1)
- allow $1 wicked_log_t:dir list_dir_perms;
- append_files_pattern($1, wicked_log_t, wicked_log_t)
- allow $1 wicked_log_t:file map;
-
-')
-
-#######################################
-##
-## Allow the specified domain to manage
-## to Network Manager lib files.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_manage_lib',`
- gen_require(`
- type wicked_var_lib_t;
- ')
-
- manage_files_pattern($1, wicked_var_lib_t, wicked_var_lib_t)
- allow $1 wicked_var_lib_t:file map;
-
-')
-
-#######################################
-##
-## Send to wicked with a unix dgram socket.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_dgram_send',`
- gen_require(`
- type wicked_t, wicked_var_run_t;
- ')
-
- files_search_pids($1)
- dgram_send_pattern($1, wicked_var_run_t, wicked_var_run_t, wicked_t)
-')
-
-########################################
-##
-## Send sigchld to wicked.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-#
-interface(`wicked_sigchld',`
- gen_require(`
- type wicked_t;
- ')
-
- allow $1 wicked_t:process sigchld;
-')
-
-########################################
-##
-## Send signull to wicked.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-#
-interface(`wicked_signull',`
- gen_require(`
- type wicked_t;
- ')
-
- allow $1 wicked_t:process signull;
-')
-
-########################################
-##
-## Send sigkill to wicked.
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-#
-interface(`wicked_sigkill',`
- gen_require(`
- type wicked_t;
- ')
-
- allow $1 wicked_t:process sigkill;
-')
-
-########################################
-##
-## Transition to wicked named content
-##
-##
-##
-## Domain allowed access.
-##
-##
-#
-interface(`wicked_filetrans_named_content',`
- gen_require(`
- type wicked_var_run_t;
- type wicked_var_lib_t;
- ')
-
-
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth0.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth1.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth2.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth3.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth4.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth5.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth6.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth7.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth8.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth9.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth0.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth1.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth2.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth3.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth4.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth5.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth6.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth7.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth8.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.eth9.dhcp.ipv6")
-
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em0.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em1.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em2.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em3.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em4.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em5.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em6.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em7.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em8.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em9.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em0.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em1.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em2.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em3.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em4.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em5.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em6.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em7.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em8.dhcp.ipv6")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.em9.dhcp.ipv6")
-
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.lo.dhcp.ipv4")
- files_pid_filetrans($1, wicked_var_run_t, file, "leaseinfo.lo.dhcp.ipv6")
-
- files_pid_filetrans($1, wicked_var_run_t, dir, "extension")
- files_pid_filetrans($1, wicked_var_run_t, dir, "nanny")
-
- files_etc_filetrans($1, wicked_var_lib_t, file, "state-1.xml")
- files_etc_filetrans($1, wicked_var_lib_t, file, "state-2.xml")
- files_etc_filetrans($1, wicked_var_lib_t, file, "state-3.xml")
- files_etc_filetrans($1, wicked_var_lib_t, file, "state-4.xml")
- files_etc_filetrans($1, wicked_var_lib_t, file, "state-5.xml")
- files_etc_filetrans($1, wicked_var_lib_t, file, "state-6.xml")
- files_etc_filetrans($1, wicked_var_lib_t, file, "state-7.xml")
- files_etc_filetrans($1, wicked_var_lib_t, file, "state-8.xml")
- files_etc_filetrans($1, wicked_var_lib_t, file, "state-9.xml")
-')
-
-########################################
-##
-## Create a set of derived types for various wicked scripts
-##
-##
-##
-## The name to be used for deriving type names.
-##
-##
-#
-template(`wicked_script_template',`
- gen_require(`
- attribute wicked_plugin, wicked_script;
- type wicked_t;
- ')
-
- type wicked_$1_t, wicked_plugin;
- type wicked_$1_script_t, wicked_script;
- application_domain(wicked_$1_t, wicked_$1_script_t)
- role system_r types wicked_$1_t;
-
- domtrans_pattern(wicked_t, wicked_$1_script_t, wicked_$1_t)
-')
diff --git a/wicked.te b/wicked.te
deleted file mode 100644
index 8747b97..0000000
--- a/wicked.te
+++ /dev/null
@@ -1,572 +0,0 @@
-policy_module(wicked, 1.0.0)
-
-########################################
-#
-# Declarations
-#
-
-type wicked_t;
-type wicked_exec_t;
-init_daemon_domain(wicked_t, wicked_exec_t)
-
-type wicked_initrc_exec_t;
-init_script_file(wicked_initrc_exec_t)
-
-type wicked_unit_file_t;
-systemd_unit_file(wicked_unit_file_t)
-
-type wicked_etc_t;
-files_config_file(wicked_etc_t)
-
-type wicked_etc_rw_t;
-files_config_file(wicked_etc_rw_t)
-
-#type wicked_log_t;
-#logging_log_file(wicked_log_t)
-
-type wicked_tmp_t;
-files_tmp_file(wicked_tmp_t)
-
-type wicked_var_lib_t;
-files_type(wicked_var_lib_t)
-
-type wicked_var_run_t;
-files_pid_file(wicked_var_run_t)
-
-
-# Wicked scripts
-
-attribute wicked_plugin;
-attribute wicked_script;
-type wicked_script_t, wicked_script;
-type wicked_custom_t, wicked_plugin;
-role system_r types wicked_custom_t;
-application_domain(wicked_custom_t, wicked_script_t)
-domtrans_pattern(wicked_t, wicked_script_t, wicked_custom_t)
-
-wicked_script_template(winbind);
-wicked_script_template(dhcp);
-
-#type wpa_cli_t;
-#type wpa_cli_exec_t;
-#init_system_domain(wpa_cli_t, wpa_cli_exec_t)
-
-########################################
-#
-# Local policy
-#
-
-# wicked will ptrace itself if gdb is installed
-# and it receives a unexpected signal (rh bug #204161)
-allow wicked_t self:capability { fowner chown fsetid kill setgid setuid sys_admin sys_nice dac_read_search dac_override net_admin net_raw net_bind_service ipc_lock sys_chroot };
-dontaudit wicked_t self:capability sys_tty_config;
-
-allow wicked_t self:bpf { map_create map_read map_write prog_load prog_run };
-
-ifdef(`hide_broken_symptoms',`
- # caused by some bogus kernel code
- dontaudit wicked_t self:capability sys_module;
-')
-# alternatively allow with
-# kernel_load_module( wicked_t )
-
-allow wicked_t self:process { getcap setcap setpgid getsched setsched signal_perms };
-
-allow wicked_t self:process setfscreate;
-selinux_validate_context(wicked_t)
-
-tunable_policy(`deny_ptrace',`',`
- allow wicked_t self:capability sys_ptrace;
- allow wicked_t self:process ptrace;
-')
-
-allow wicked_t self:fifo_file rw_fifo_file_perms;
-allow wicked_t self:unix_dgram_socket { sendto create_socket_perms };
-allow wicked_t self:unix_stream_socket{ create_stream_socket_perms connectto };
-allow wicked_t self:netlink_generic_socket create_socket_perms;
-allow wicked_t self:netlink_route_socket create_netlink_socket_perms;
-allow wicked_t self:netlink_xfrm_socket create_netlink_socket_perms;
-allow wicked_t self:netlink_socket create_socket_perms;
-allow wicked_t self:netlink_kobject_uevent_socket create_socket_perms;
-allow wicked_t self:tcp_socket create_stream_socket_perms;
-allow wicked_t self:tun_socket { create_socket_perms relabelfrom relabelto };
-allow wicked_t self:udp_socket create_socket_perms;
-allow wicked_t self:packet_socket create_socket_perms;
-allow wicked_t self:rawip_socket create_socket_perms;
-allow wicked_t self:socket create_socket_perms;
-
-tunable_policy(`deny_bluetooth',`',`
- allow wicked_t self:bluetooth_socket create_stream_socket_perms;
-')
-
-#allow wicked_t wpa_cli_t:unix_dgram_socket sendto;
-
-can_exec(wicked_t, wicked_exec_t)
-#wicd
-# can_exec(wicked_t, wpa_cli_exec_t)
-
-list_dirs_pattern(wicked_t, wicked_initrc_exec_t, wicked_initrc_exec_t)
-read_files_pattern(wicked_t, wicked_initrc_exec_t, wicked_initrc_exec_t)
-read_lnk_files_pattern(wicked_t, wicked_initrc_exec_t, wicked_initrc_exec_t)
-
-list_dirs_pattern(wicked_t, wicked_etc_t, wicked_etc_t)
-read_files_pattern(wicked_t, wicked_etc_t, wicked_etc_t)
-read_lnk_files_pattern(wicked_t, wicked_etc_t, wicked_etc_t)
-
-read_lnk_files_pattern(wicked_t, wicked_etc_rw_t, wicked_etc_rw_t)
-manage_dirs_pattern(wicked_t, wicked_etc_rw_t, wicked_etc_rw_t)
-manage_files_pattern(wicked_t, wicked_etc_rw_t, wicked_etc_rw_t)
-filetrans_pattern(wicked_t, wicked_etc_t, wicked_etc_rw_t, { dir file })
-
-#allow wicked_t wicked_log_t:dir setattr_dir_perms;
-#append_files_pattern(wicked_t, wicked_log_t, wicked_log_t)
-#create_files_pattern(wicked_t, wicked_log_t, wicked_log_t)
-#setattr_files_pattern(wicked_t, wicked_log_t, wicked_log_t)
-#logging_log_filetrans(wicked_t, wicked_log_t, file)
-
-can_exec(wicked_t, wicked_tmp_t)
-manage_files_pattern(wicked_t, wicked_tmp_t, wicked_tmp_t)
-manage_sock_files_pattern(wicked_t, wicked_tmp_t, wicked_tmp_t)
-files_tmp_filetrans(wicked_t, wicked_tmp_t, { sock_file file })
-
-manage_dirs_pattern(wicked_t, wicked_var_lib_t, wicked_var_lib_t)
-manage_files_pattern(wicked_t, wicked_var_lib_t, wicked_var_lib_t)
-manage_lnk_files_pattern(wicked_t, wicked_var_lib_t, wicked_var_lib_t)
-files_var_lib_filetrans(wicked_t, wicked_var_lib_t, { dir file lnk_file })
-
-manage_dirs_pattern(wicked_t, wicked_var_run_t, wicked_var_run_t)
-manage_files_pattern(wicked_t, wicked_var_run_t, wicked_var_run_t)
-manage_sock_files_pattern(wicked_t, wicked_var_run_t, wicked_var_run_t)
-files_pid_filetrans(wicked_t, wicked_var_run_t, { dir file sock_file })
-
-kernel_read_system_state(wicked_t)
-kernel_read_network_state(wicked_t)
-kernel_read_kernel_sysctls(wicked_t)
-kernel_request_load_module(wicked_t)
-kernel_read_debugfs(wicked_t)
-kernel_rw_net_sysctls(wicked_t)
-kernel_dontaudit_setsched(wicked_t)
-kernel_signull(wicked_t)
-
-corenet_ib_manage_subnet_unlabeled_endports(wicked_t)
-corenet_ib_access_unlabeled_pkeys(wicked_t)
-corenet_all_recvfrom_netlabel(wicked_t)
-corenet_tcp_sendrecv_generic_if(wicked_t)
-corenet_udp_sendrecv_generic_if(wicked_t)
-corenet_raw_sendrecv_generic_if(wicked_t)
-corenet_tcp_sendrecv_generic_node(wicked_t)
-corenet_udp_sendrecv_generic_node(wicked_t)
-corenet_raw_sendrecv_generic_node(wicked_t)
-corenet_tcp_sendrecv_all_ports(wicked_t)
-corenet_udp_sendrecv_all_ports(wicked_t)
-corenet_udp_bind_generic_node(wicked_t)
-corenet_udp_bind_isakmp_port(wicked_t)
-corenet_udp_bind_dhcpc_port(wicked_t)
-corenet_tcp_connect_all_ports(wicked_t)
-corenet_sendrecv_isakmp_server_packets(wicked_t)
-corenet_sendrecv_dhcpc_server_packets(wicked_t)
-corenet_sendrecv_all_client_packets(wicked_t)
-corenet_rw_tun_tap_dev(wicked_t)
-corenet_getattr_ppp_dev(wicked_t)
-
-dev_access_check_sysfs(wicked_t)
-dev_rw_sysfs(wicked_t)
-dev_write_sysfs_dirs(wicked_t)
-dev_read_rand(wicked_t)
-dev_read_urand(wicked_t)
-dev_dontaudit_getattr_generic_blk_files(wicked_t)
-dev_getattr_all_chr_files(wicked_t)
-dev_rw_wireless(wicked_t)
-
-fs_getattr_all_fs(wicked_t)
-fs_search_auto_mountpoints(wicked_t)
-fs_list_inotifyfs(wicked_t)
-fs_read_nsfs_files(wicked_t)
-
-mls_file_read_all_levels(wicked_t)
-
-selinux_dontaudit_search_fs(wicked_t)
-
-corecmd_exec_shell(wicked_t)
-corecmd_exec_bin(wicked_t)
-
-domain_use_interactive_fds(wicked_t)
-domain_read_all_domains_state(wicked_t)
-
-files_read_etc_runtime_files(wicked_t)
-files_read_system_conf_files(wicked_t)
-files_read_usr_src_files(wicked_t)
-files_read_isid_type_files(wicked_t)
-
-storage_getattr_fixed_disk_dev(wicked_t)
-
-term_open_unallocated_ttys(wicked_t)
-
-init_read_utmp(wicked_t)
-init_dontaudit_write_utmp(wicked_t)
-init_domtrans_script(wicked_t)
-init_signull_script(wicked_t)
-init_signal_script(wicked_t)
-init_sigkill_script(wicked_t)
-
-auth_use_nsswitch(wicked_t)
-
-libs_exec_ldconfig(wicked_t)
-
-logging_send_syslog_msg(wicked_t)
-logging_send_audit_msgs(wicked_t)
-
-miscfiles_read_generic_certs(wicked_t)
-
-seutil_read_config(wicked_t)
-seutil_run_setfiles(wicked_t, system_r)
-
-sysnet_domtrans_ifconfig(wicked_t)
-sysnet_domtrans_dhcpc(wicked_t)
-sysnet_signal_dhcpc(wicked_t)
-sysnet_signull_dhcpc(wicked_t)
-sysnet_read_dhcpc_pid(wicked_t)
-sysnet_read_dhcp_config(wicked_t)
-sysnet_delete_dhcpc_pid(wicked_t)
-sysnet_kill_dhcpc(wicked_t)
-sysnet_read_dhcpc_state(wicked_t)
-sysnet_delete_dhcpc_state(wicked_t)
-sysnet_search_dhcp_state(wicked_t)
-# in /etc created by wicked will be labelled net_conf_t.
-sysnet_manage_config(wicked_t)
-sysnet_filetrans_named_content(wicked_t)
-sysnet_filetrans_net_conf(wicked_t)
-
-systemd_machined_read_pid_files(wicked_t)
-
-term_use_unallocated_ttys(wicked_t)
-
-userdom_stream_connect(wicked_t)
-userdom_dontaudit_use_unpriv_user_fds(wicked_t)
-userdom_dontaudit_use_user_ttys(wicked_t)
-# Read gnome-keyring
-userdom_read_home_certs(wicked_t)
-userdom_read_user_home_content_files(wicked_t)
-userdom_dgram_send(wicked_t)
-
-hostname_exec(wicked_t)
-wicked_systemctl(wicked_t)
-
-sysnet_manage_config_dirs(wicked_t)
-
-
-# Wicked scripts
-
-list_dirs_pattern(wicked_t, wicked_script_t, wicked_script)
-read_files_pattern(wicked_t, wicked_script_t, wicked_script)
-read_lnk_files_pattern(wicked_t, wicked_script_t, wicked_script)
-list_dirs_pattern(wicked_plugin, wicked_script_t, wicked_script_t)
-read_lnk_files_pattern(wicked_plugin, wicked_script_t, wicked_script)
-
-auth_read_passwd(wicked_plugin)
-
-corecmd_exec_bin(wicked_plugin)
-corecmd_exec_shell(wicked_winbind_t)
-
-#tunable_policy(`use_nfs_home_dirs',`
-# fs_read_nfs_files(wicked_t)
-#')
-#
-#tunable_policy(`use_samba_home_dirs',`
-# fs_read_cifs_files(wicked_t)
-#')
-
-optional_policy(`
- avahi_domtrans(wicked_t)
- avahi_kill(wicked_t)
- avahi_signal(wicked_t)
- avahi_signull(wicked_t)
- avahi_dbus_chat(wicked_t)
-')
-
-optional_policy(`
- packagekit_dbus_chat(wicked_t)
-')
-
-optional_policy(`
- firewalld_dbus_chat(wicked_t)
-')
-
-optional_policy(`
- wicked_dbus_chat(wicked_t)
-')
-
-optional_policy(`
- bind_domtrans(wicked_t)
- bind_manage_cache(wicked_t)
- bind_kill(wicked_t)
- bind_signal(wicked_t)
- bind_signull(wicked_t)
-')
-
-optional_policy(`
- bluetooth_dontaudit_read_helper_state(wicked_t)
-')
-
-optional_policy(`
- consoletype_exec(wicked_t)
-')
-
-optional_policy(`
- cron_read_system_job_lib_files(wicked_t)
-')
-
-optional_policy(`
- chronyd_domtrans_chronyc(wicked_t)
- chronyd_domtrans(wicked_t)
-')
-
-optional_policy(`
- dbus_system_domain(wicked_t, wicked_exec_t)
-
- init_dbus_chat(wicked_t)
-
- optional_policy(`
- consolekit_dbus_chat(wicked_t)
- consolekit_read_pid_files(wicked_t)
- ')
-')
-
-optional_policy(`
- dnsmasq_read_pid_files(wicked_t)
- dnsmasq_dbus_chat(wicked_t)
- dnsmasq_delete_pid_files(wicked_t)
- dnsmasq_domtrans(wicked_t)
- dnsmasq_initrc_domtrans(wicked_t)
- dnsmasq_kill(wicked_t)
- dnsmasq_signal(wicked_t)
- dnsmasq_signull(wicked_t)
- dnsmasq_systemctl(wicked_t)
-')
-
-optional_policy(`
- dnssec_trigger_domtrans(wicked_t)
- dnssec_trigger_signull(wicked_t)
- dnssec_trigger_sigkill(wicked_t)
-')
-
-optional_policy(`
- fcoe_dgram_send_fcoemon(wicked_t)
-')
-
-optional_policy(`
- howl_signal(wicked_t)
-')
-
-optional_policy(`
- gnome_dontaudit_search_config(wicked_t)
-')
-
-optional_policy(`
- iscsid_domtrans(wicked_t)
-')
-
-optional_policy(`
- iodined_domtrans(wicked_t)
-')
-
-optional_policy(`
- ipsec_domtrans_mgmt(wicked_t)
- ipsec_kill_mgmt(wicked_t)
- ipsec_signal_mgmt(wicked_t)
- ipsec_signull_mgmt(wicked_t)
- ipsec_domtrans(wicked_t)
- ipsec_kill(wicked_t)
- ipsec_signal(wicked_t)
- ipsec_signull(wicked_t)
-')
-
-optional_policy(`
- iptables_domtrans(wicked_t)
-')
-
-optional_policy(`
- l2tpd_domtrans(wicked_t)
- l2tpd_sigkill(wicked_t)
- l2tpd_signal(wicked_t)
- l2tpd_signull(wicked_t)
-')
-
-optional_policy(`
- lldpad_dgram_send(wicked_t)
-')
-
-optional_policy(`
- kdump_dontaudit_inherited_kdumpctl_tmp_pipes(wicked_t)
-')
-
-optional_policy(`
- netutils_exec_ping(wicked_t)
- netutils_exec(wicked_t)
-')
-
-optional_policy(`
- nscd_domtrans(wicked_t)
- nscd_signal(wicked_t)
- nscd_signull(wicked_t)
- nscd_kill(wicked_t)
- nscd_initrc_domtrans(wicked_t)
- nscd_systemctl(wicked_t)
-')
-
-optional_policy(`
- # Dispatcher starting and stoping ntp
- ntp_initrc_domtrans(wicked_t)
- ntp_systemctl(wicked_t)
-')
-
-optional_policy(`
- modutils_domtrans_kmod(wicked_t)
-')
-
-optional_policy(`
- openvpn_read_config(wicked_t)
- openvpn_domtrans(wicked_t)
- openvpn_kill(wicked_t)
- openvpn_signal(wicked_t)
- openvpn_signull(wicked_t)
- openvpn_stream_connect(wicked_t)
- openvpn_noatsecure(wicked_t)
-')
-
-optional_policy(`
- policykit_dbus_chat(wicked_t)
- policykit_domtrans_auth(wicked_t)
- policykit_read_lib(wicked_t)
- policykit_read_reload(wicked_t)
- userdom_read_all_users_state(wicked_t)
-')
-
-optional_policy(`
- polipo_systemctl(wicked_t)
-')
-
-optional_policy(`
- ppp_initrc_domtrans(wicked_t)
- ppp_domtrans(wicked_t)
- ppp_manage_pid_files(wicked_t)
- ppp_kill(wicked_t)
- ppp_signal(wicked_t)
- ppp_signull(wicked_t)
- ppp_read_config(wicked_t)
- ppp_systemctl(wicked_t)
-')
-
-optional_policy(`
- rpm_exec(wicked_t)
- rpm_read_db(wicked_t)
- rpm_dontaudit_manage_db(wicked_t)
-')
-
-optional_policy(`
- samba_service_status(wicked_t)
-')
-
-optional_policy(`
- seutil_sigchld_newrole(wicked_t)
-')
-
-optional_policy(`
- sysnet_manage_dhcpc_state(wicked_t)
-')
-
-optional_policy(`
- systemd_write_inhibit_pipes(wicked_t)
- systemd_read_logind_sessions_files(wicked_t)
- systemd_dbus_chat_logind(wicked_t)
- systemd_dbus_chat_hostnamed(wicked_t)
- systemd_hostnamed_manage_config(wicked_t)
-')
-
-optional_policy(`
- ssh_basic_client_template(wicked, wicked_t, system_r)
- term_use_generic_ptys(wicked_ssh_t)
- modutils_domtrans_kmod(wicked_ssh_t)
- dbus_connect_system_bus(wicked_ssh_t)
- dbus_system_bus_client(wicked_ssh_t)
-
- wicked_dbus_chat(wicked_ssh_t)
-')
-
-optional_policy(`
- udev_exec(wicked_t)
- udev_read_db(wicked_t)
- udev_read_pid_files(wicked_t)
-')
-
-optional_policy(`
- vpn_domtrans(wicked_t)
- vpn_kill(wicked_t)
- vpn_signal(wicked_t)
- vpn_signull(wicked_t)
- vpn_relabelfrom_tun_socket(wicked_t)
-')
-
-optional_policy(`
- openfortivpn_domtrans(wicked_t)
- openfortivpn_sigkill(wicked_t)
- openfortivpn_signal(wicked_t)
- openfortivpn_signull(wicked_t)
-')
-
-optional_policy(`
- openvswitch_stream_connect(wicked_t)
-')
-
-optional_policy(`
- virt_dbus_chat(wicked_t)
-')
-
-optional_policy(`
- networkmanager_dbus_chat(wicked_t)
-')
-
-optional_policy(`
- logging_send_syslog_msg(wicked_winbind_t)
-')
-
-optional_policy(`
- sysnet_exec_ifconfig(wicked_plugin)
- sysnet_read_config(wicked_plugin)
-')
-
-optional_policy(`
- systemd_exec_systemctl(wicked_winbind_t)
- systemd_exec_systemctl(wicked_dhcp_t)
-')
-
-optional_policy(`
- samba_domtrans_smbcontrol(wicked_winbind_t)
- samba_read_config(wicked_winbind_t)
- samba_service_status(wicked_winbind_t)
-')
-
-#tunable_policy(`use_ecryptfs_home_dirs',`
-#fs_manage_ecryptfs_files(wicked_t)
-#')
-
-########################################
-#
-# wpa_cli local policy
-#
-
-#allow wpa_cli_t self:capability { dac_read_search };
-#allow wpa_cli_t self:unix_dgram_socket create_socket_perms;
-#
-#allow wpa_cli_t wicked_t:unix_dgram_socket sendto;
-#
-#manage_sock_files_pattern(wpa_cli_t, wicked_tmp_t, wicked_tmp_t)
-#files_tmp_filetrans(wpa_cli_t, wicked_tmp_t, sock_file)
-#
-#list_dirs_pattern(wpa_cli_t, wicked_var_run_t, wicked_var_run_t)
-#rw_sock_files_pattern(wpa_cli_t, wicked_var_run_t, wicked_var_run_t)
-#
-#init_dontaudit_use_fds(wpa_cli_t)
-#init_use_script_ptys(wpa_cli_t)
-#
-#term_dontaudit_use_console(wpa_cli_t)